SCVMM Self-Service Portal

Recently I got a chance to play with SCVMM Self-Service Portal and deployed in a test environment. I found it is quite an useful tools to provision virtual machines in term of time saving and consumes lesser human resource, especially in large environment, where as the member of departments able to deploy own VM self-service.

Introduction of SCVMM Self-Service Portal (SSP)

SSP is a component of Microsoft System Center Virtual Machine Manager, where SCVMM is required in order to run SSP. SSP is cloud based application, it requires a web server to host, and this web server will communicate with SCVMM server. The SSP is like a middleman, to allow user to communicate with SCVMM via a web interface. In order to use SSP, the user must have Internet Explorer installed on the computer, as ActiveX is required for SSP.

The main purpose of using SSP is to allow the user to self-provision their own VMs on Hyper-V host.

SCVMM server is used to communicate and administrate Hyper-V host group which already consolidated. By using the web interface to logon to SSP, user will be able to provision and manage own VMs.

This product is specially made for the environment which lack of human resource to provision and manage virtual machines to end user, due to excessive demand.

Differences of VMM SSP and SCVMM Console

SCVMM Console is actually a console solely build for administrative purposes, such as like managing host group, VM provisioning and managing, create and modify VM templates, resource management and optimization of virtual environment. VMM SSP is actually a console solely built for end user, with a limited features and functions compared to SCVMM Console. The purposed of VMM SSP is mainly allow end users to provision and manage their own VMs, the user in SSP do not have any rights to administrate other users in SSP. The rights of users in SSP can be assigned by using SCVMM Console.

Self-Provisioning

By using VMM SSP, end users will be allowed to self-provision and manage their own VMs by using the web interface. The web interface is simple and user friendly as shown above. The provisioned VMs are based on VM template. The VM template is created in SCVMM Console by SCVMM administrators.

In the same time, the user also allows to connect and remote desktop to the VMs using web interface.

Simple and user friendly web interface for end user

This interface of SSP is simple and can be understand easily.

Assign user rights according to user type

The administrator can assign different rights to end user according to user type. The screenshot above shown the rights assigned to the user group. The administrator also able to assign the VM to deploy to particular Hyper-V host group based to respective user type. For example, user type A will only deploy VM to Hyper-V host group A.

Set boundary to users to avoid excessive provisioning

SSP allows end user to self-provision VMs for themselves, however, if the VM deployment didn’t controlled properly, this will lead to resources depletion.

SSP introduce Quota Point to allow administrator to control resource allocation effectively. Administrator can assign a maximum quota to a user group, and also quota point required for deployment on VM templates. End user able to provision VMs, and the quota points will be deducted after the provisioning, the point deducted is based on quota point of template.

By using Quota Point feature, administrator can assign the VMs template quota point based on how much resource consumed for deployment. For example, assign 2 quota points for a VM required 4GB of RAM, and 1 quota point for VM required 2GB of RAM. Indirectly, administrator can keep track of software license used by end user.

Extras

During the first time I remote accessed to VM using computer out of domain, the SSP prompted me for domain user and password when I trying to access to VM. This is because the computer does not have credentials to access the resources in the domain. As for Win 7, it will prompt for user name and password, however in Win XP, the web interface will prompt error and without asking for credentials.

In order to overcome this problem, on the login page of SSP, select Store my credentials. This will allows SSP to carry the credentials entered in this page to access VM within the domain. It is quite useful for computer out of domain.

It is recommended to update all VMs version into latest version to make VMs compatible with SSP. I have faced this problem during my Win XP deployment, where the VM unable to be remote accessed via web interface as the Win XP version is SP2, after I updated it to SP3, it has no problem to be remote accessed via web interface.

Symantec Endpoint Protection Installation Issue on Win7

Recently I had tried to deploy SEP on an Windows 7 client PC. The installation keep failing stated that the installation rolled back. This is a common issue for Windows 7 when trying to install SEP version 11.0. 

Here is the solution to solve this problem, it is caused by LiveUpdate.

To check the installation log

Click Start > Run
Type %temp% and click OK.
Open the file "SEP_INST.LOG" in a text editor, and look for the following text:
-- DECABI_LOGGING -- Enter LURegisterDecomposerABI()
-- DECABI_LOGGING -- LiveUpdate registration failed. (HRESULT=-2147221164)

If those entries exist, remove any leftover Symantec program files and then install Symantec Endpoint Protection.

To remove leftover Symantec program files

Delete the following folders (if they exist):
C:\Program Files\Symantec
C:\Program Files\Symantec Antivirus
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate
or c:\program data\symantec\liveupdate (Windows 7 or Windows Server 2008)
Install LiveUpdate by running the following file from CD1:
\SEP\LUSETUP.EXE
NOTE: Do not install LiveUpdate version 3.4 or newer (available from Symantec's FTP site). As of this writing, LiveUpdate 3.3 is the only version supported with enterprise products.
Install Symantec Endpoint Protection.

http://www.symantec.com/business/support/index?page=content&id=TECH102674&locale=en_US

Difference Between Remote Desktop and mstsc /console

In Windows Server 2003, when you use Terminal Services, you can connect to the console session (session 0), and at the same time, open a shadow session to it (as long as you connect from a session other than the console). With this added functionality, you can log on to a Windows Server 2003-based server that is running Terminal Services remotely and interact with session 0 as if you were sitting at the physical console of the computer. This session can also be shadowed so that the remote user and the local user at the physical console can see and interact with the same session.

While for normal Remote Desktop Connection, the session will remained in remote computer after user disconnected. However, the user will not be able to login to continue that session. The user need to manually connect back to that session.

"The user domain\username is logged locally on to this computer. The user has been idled for number minutes. The desktop is unlocked. If you continue, this user's session will end and any unsaved data will be lost."

Normal remote desktop command,

mstsc {target_computer_name}

Remote desktop to console session,

mstsc /console {target_computer_name}

http://support.microsoft.com/kb/278845

Troubleshooting SCCM Client Deployment Issue

Recently I have involved in a SCCM client deployment project in an company, the server has done setup and my responsible is to deploy every computer with SCCM client.

SCCM client is a client software provided by SCCM, as a receiver on client computer to receive any updates pushed from SCCM server. Most of the client computer has been installed with SCCM client by using group policy, however, partial computers has not installed properly, due to some issues. Here is the list of common issues which I encountered during deployment. The setup log can be found in the following location.

\windows\system32\ccmsetup\ccmsetup.logThis is the common I had encountered.

1. WMI corrupted or services unable to start

2. BITS service unable to start

3. Error 1603

4. WINS enabled

To deploy SCCM client, firstly the installer is needed. Before the installation begins, ccmclean.exe must be ran to ensure the computer is cleaned from existing SCCM installation. Next, WINS has to be disabled. The server will not able to update the computer with WINS in list of SCCM console. In this environment, WINS has been already not used, however, the WINS records still remained in client computers. To check the computer whether WINS is disabled, go to command prompt and type ipconfig /all, and make sure WINS proxy enabled is NO. If WINS is enabled, type in the following commands to refresh ipconfig,

ipconfig /release

ipconfig /renew

Troubleshooting BITS issue

I encountered this issue on several computer, where the computer has installed with SCCM client, however it cannot be started. Culprit was BITS service was not started.

If BITS unable to get started, apply BITS patch from Microsoft from the following link.

http://www.microsoft.com/downloads/details.aspx?FamilyID=8771DBBA-58B3-4EC3-B373-AA23F23AD0DF&displaylang=ko

Else, can try using this method,

Click Start > Run

Type “cmd“

In CMD, type “regsvr32 qmgr.dll” & hit enter

Also type “regsvr32 qmgrprxy.dll” & hit enter

Exit CMD

Troubleshooting WMI Issue

Certain client computer Windows Management Instrumentation were not shown as Started or ccmsetup.log indicates WMI issue.

This problem might caused by WMI repository corrupted. So I need to get Windows to create a new repository to overwrite corrupted one. Here are the steps,

1. Disable WMI service.

2. Go to c:\windows\system32\wbem\Repository

3. Rename "Repository" folder to "oldRepository"

4. Enable WMI service.

5. Restart SCCM client installation.

After doing this, a new Repository folder will appear in wbem folder, means Windows has create a WMI repository and replace the old one.

If WMI service missing from services, can try this method,

1. Go to cmd

2. run rundll32 wbemupgd, UpgradeRepository

3. Recheck WMI service in services.

Troubleshooting Error 1603

1) Uninstall the SCCM client from the target computer

2) Open a command line on the target and type REGSVR32 ATL.DLL

3) Reinstall the client using CCMSETUP

After the deployment of SCCM client, the computer names will not update to server on SCCM

console immediately, it took up to 7 days to appear in the list.